Fixes postmodern#529 FreeBSD provides OpenSSL as part of its base system and it is configured to use the certs that are also provided as part of the base system (/etc/ssl/cert.pem). The 'openssl' package that ruby-install currently uses does not ship any certs and after install a simple HTTPS request will fail: ``` ruby -rnet/http -e 'p Net::HTTP.get_response(URI.parse("https://google.com"))' /../4.0.0/net/protocol.rb:46:in 'OpenSSL::SSL::SSLSocket#connect_nonblock': SSL_connect returned=1 errno=0 peeraddr=142.250.219.206:443 state=error: certificate verify failed (unable to get local issuer certificate) (OpenSSL::SSL::SSLError) OpenSSL error queue reported 0 errors: ``` The 'ca_root_nss' package does provide certs, but not in a location that the OpenSSL package will look. It would require extra steps that are more complicated than depending on the base system's OpenSSL. This change was tested in isolation, on an empty jail that is based on 16-CURRENT. This is the script I used, and it might be useful for your own tests: ```sh set -ex jobs=$(sysctl -n hw.ncpu) if [ "$(id -u)" != "0" ]; then echo "you must be root" exit 1 fi if [ ! -e "/tmp/ruby-install" ]; then bsdinstall jail /tmp/ruby-install fi PREFIX=/usr/local DESTDIR=/tmp/ruby-install make install jail -n ruby-install -c path=/tmp/ruby-install \ host.hostname=ruby-install \ ip4=inherit \ persist \ mount.devfs \ devfs_ruleset=4 \ exec.start="/bin/sh /etc/rc" \ exec.stop="/bin/sh /etc/rc.shutdown jail" pkg -j ruby-install install -y bash curl jexec -u root ruby-install ruby-install "ruby" "4.0.7" "-j" "${jobs}" "--prefix" "/usr/local" jexec -u root ruby-install ruby -rnet/http -e 'p Net::HTTP.get_response(URI("https://ruby-lang.org"))' jail -r ruby-install ```

Commits

Commits on Oct 20, 2026

freebsd: fix broken OpenSSL configuration